Why is it still possible to recover files that have been emptied from the Recycle Bin on a Windows computer?

The data is still present until the original location of the file is used

The data is moved to the Restore directory and is kept there indefinitely

The data will reside in the L2 cache on a Windows computer until it is manually deleted

It is not possible to recover data that has been emptied from the Recycle Bin

When is it appropriate to use computer forensics?

If copyright and intellectual property theft/misuse has occurred

If employees do not care for their boss management techniques

If sales drop off for no apparent reason for an extended period of time

If a financial institution is burglarized by robbers

Using Linux to carry out a forensics investigation, what would the following command accomplish? dd if=/usr/home/partition.image of=/dev/sdb2 bs=4096 conv=notrunc,noerror

Restore a disk from an image file

Search for disk errors within an image file

Copy a partition to an image file

Restore a disk from an image file

In handling computer-related incidents, which IT role should be responsible for recovery, containment, and prevention to constituents?

Director of Information Technology

What will the following Linux command accomplish? dd if=/dev/mem of=/home/sam/mem.bin bs=1024

Copy the running memory to a file

Copy the master boot record to a file

Copy the contents of the system folder to a file

Copy the running memory to a file

Copy the memory dump file to an image file

Why would you need to find out the gateway of a device when investigating a wireless attack?

The gateway will be the IP used to manage the access point

The gateway will be the IP of the proxy server used by the attacker to launch the attack

The gateway will be the IP of the attacker computer

The gateway will be the IP used to manage the RADIUS server

The gateway will be the IP used to manage the access point

Why would a company issue a dongle with the software they sell?

To provide copyright protection

To provide source code protection

To provide wireless functionality with the software

To provide copyright protection

To ensure that keyloggers cannot be used

While searching through a computer under investigation, you discover numerous files that appear to have had the first letter of the file name replaced by the hex code byte 5h. What does this indicate on the computer?

The files have been marked for deletion

The files have been marked as hidden

The files have been marked for deletion

The files are corrupt and cannot be recovered

The files have been marked as read-only

While presenting his case to the court, Simon calls many witnesses to the stand to testify. Simon decides to call Hillary Taft, a lay witness, to the stand. Since Hillary is a lay witness, what field would she be considered an expert in?

Technical material related to forensics

Judging the character of defendants/victims

Who is responsible for the following tasks?

Local managers or other non-forensic staff

Watson, a forensic investigator, is examining a copy of an ISO file stored in CDFS format. What type of evidence is this?

Data from a CD copied using Windows

Data from a CD copied using Mac-based system

Data from a DVD copied using Windows system

Data from a CD copied using Linux system

ECCouncil 312-49v10 Practice Test 8 - Free Online Exam Prep & Questions

On an Active Directory network using NTLM authentication, where on the domain controllers are the passwords stored?

SAM

AMS

Shadow file

Password.conf

Comment (0)

ECCouncil 312-49v10 Practice Test 8

Question

ECCouncil 312-49v10 Practice Tests

Practice Tests